sanity check on address family matches between tunnel policy and
SPD filter specification. For example, the following returns EINVAL:
spdadd ::1 ::1 any -P out ipsec tunnel/10.1.1.1-10.1.1.1/use;
XXX more tests - make sure it is not too strict